Identity Security Architecture

Why identity architecture matters

Every access decision your organisation makes runs through Entra ID. When that layer is configured reactively — MFA deployed here, a Conditional Access policy copied there — the boundaries are inconsistent and attackers move through the gaps. Architecture means designing every identity control to enforce the same model so there are no exceptions that weren't deliberate.

What this engagement covers

Global Admin audit and role reduction

Global Admin is the most powerful role in any Microsoft 365 tenant. One compromised GA account gives an attacker complete control — every user, every setting, every piece of data. Most tenants accumulate GA accounts quietly: setup partners assign it temporarily and never remove it, owners use their daily email account as GA out of convenience, and old IT contacts retain access long after leaving. An audit identifies exactly who holds the role, separates privileged accounts from daily-use accounts, and reduces GA to the minimum required with documented break-glass procedures.

Unified audit log activation and monitoring baseline

The Microsoft 365 unified audit log captures sign-ins, admin actions, file access, mail forwarding rules, permission changes, and consent grants across the entire tenant. In some licensing tiers it requires explicit activation — and when it is not enabled, these events are simply not recorded. Post-breach forensics becomes guesswork. Regulatory compliance reviews become difficult to pass. CISA has flagged disabled audit logging as a consistent finding in cloud incident investigations. This engagement activates logging, configures retention to match your regulatory requirements, and sets up Entra ID workbooks for ongoing sign-in and admin activity monitoring.

OAuth app consent governance

When users can grant OAuth consent to third-party applications without admin approval, every user in your tenant becomes a potential entry point. Attackers send convincing emails directing users to Microsoft's legitimate device login page — users enter a code and unknowingly grant persistent access to their mailbox, calendar, and files. The attacker receives a valid OAuth token. No password required. No MFA prompt. Proofpoint reported success rates exceeding 50% across 900+ Microsoft 365 environments in 2025. Most IT teams have no inventory of what third-party apps are already connected to their tenant, when access was granted, or by whom. This engagement closes that gap — policy, inventory, and revocation in one pass.

What you receive